Harvest now, decrypt later

Your most sensitive data is being stolen right now.It’s waiting for a quantum computer to decrypt and expose it.

Capturing your sensitive data is passive, cheap and undetectable. If it crosses a network you don’t own, assume it is being recorded right now.1 Bad actors only have to keep the recording until a quantum computer can open it, and the latest research keeps moving that day closer.2–4When it comes, they won’t stop at today’s traffic. They’ll decrypt everything they took from you.The theft will be years old.
Your liability will be brand new.

How the attack works
  1. TodayCapturedYour encrypted traffic is copied off the link. It has likely been happening for years, and you never saw it.
  2. For yearsStoredYour data sits in an archive, ready and waiting. The attacker is patient. When Q‑Day comes, the wait pays off.
  3. Q-DayDecryptedQ‑Day is when a quantum computer can break today’s key exchange.5 Years of your recorded data are exposed at once.So are you.
What you can still protect

What’s already been recorded can’t be un‑recorded, by us or by anyone. Everything that hasn’t been recorded is still yours to protect.

PacketLoq protects your data in motion from the day it’s installed. Until then, every day your links run on today’s key exchange adds another day to the attacker’s archive. Switch, and let them record. On Q‑Day, it still won’t open.

Request a demonstration How we stop it
20x
fewer qubits needed to break RSA‑2048

In 2025, Google’s Craig Gidney cut the estimated hardware needed to break RSA-2048 about twentyfold, using better algorithms alone.2 The target is the key exchange. AES‑256, which encrypts the data itself, holds up well; the RSA or elliptic‑curve exchange that sets it up does not.

28–49%
expert odds of Q‑Day within ten years

The Global Risk Institute’s 2025 survey of quantum experts put the chance of a computer that can break today’s key exchange within ten years at 28–49%, the highest in the report’s history.4

2030
U.S. deadline to get ahead of Q‑Day

Executive Order 14412 requires post-quantum key establishment on high-value federal systems by December 31, 2030, and directs federal contractors to follow.1

Payments, patient records, contracts, control traffic.
Most of it is still sensitive in ten years.

So ask yourself, “Is my data safe when quantum arrives?”If it isn’t, are you ready for the fallout?

What it looks like on your wire

The difference is the first two frames.

The same site-to-site link, recorded on IPsec and then on PacketLoq.

Your link today · IPsec
capture · branch ↔ core
No.SourceProtocolInfo
1203.0.113.4ISAKMPIKE_SA_INIT   key exchange payload
2198.51.100.9ISAKMPIKE_SA_INIT   key exchange payload
3203.0.113.4ISAKMPIKE_AUTH
4203.0.113.4ESPSPI=0x8f2a1c04   encrypted
5198.51.100.9ESPSPI=0x1d77b930   encrypted
…ESPevery packet that follows
Break the two highlighted frames and everything below them opens. Those two frames are the key exchange, sent in the open. They’re what Shor’s algorithm was designed to break.5
The same link · PacketLoq
capture · branch ↔ core
No.SourceProtocolInfo
1203.0.113.4UDP9876 → 9876   Len=1422
2198.51.100.9UDP9876 → 9876   Len=1422
3203.0.113.4UDP9876 → 9876   Len=1422
4198.51.100.9UDP9876 → 9876   Len=1422
5203.0.113.4UDP9876 → 9876   Len=1422
…UDPevery packet that follows
Nothing is highlighted, because there’s no key exchange to see. Every frame looks the same, and there’s no handshake for a quantum computer to target.

Today’s key exchange is tomorrow’s breach.PacketLoq removes the weak point.

Your exposure

Every link you don’t own can be recorded today. Count yours.

Payments, identities, contracts: whatever crosses a carrier, the internet or a cloud provider can be copied now and opened on Q‑Day. Here’s a typical bank.

Your sitesTheir wire: carrier, internet, cloudHarvested here, opened later
Your core data center and your six kinds of link. Every link crosses a network you don’t own, where it can be recorded. YOUR DATA, THEIR WIRE YOUR DATA, THEIR WIRE Your coredata center Branch officesaccounts and identities Second data centera full copy of everything Clearing and settlementtransaction records Card and payment networkscard and payment data Cloud and multi-cloudbackups and analytics Remote and third partiescontracts and vendor access
Your sitesHarvested on their wire, opened later
Your coredata center
  • Branch officesaccounts and identities
  • Second data centera full copy of everything
  • Clearing and settlementtransaction records
  • Card and payment networkscard and payment data
  • Cloud and multi-cloudbackups and analytics
  • Remote and third partiescontracts and vendor access

Your sites. Your data. Your responsibility, all the way across.

None of these links is badly built.
They follow the standards the industry agreed on.But those standards didn’t plan for quantum.

“Won’t the data be old by Q‑Day?”

Some of it. Most of it will still be worth stealing.

Accounts and identitiesbranch offices
A full copy of everythingsecond data center
Backups and analyticscloud and multi-cloud
Transaction recordsclearing and settlement
Contracts and vendor accessremote and third parties
Card numbersold cards expire; new ones land in the window
Recorded todayTodayQ‑Day window opensQ‑Day window2040For life

How long each kind of data stays sensitive. The red part is still worth stealing after Q‑Day. Illustrative: your retention rules set the real lengths.

Take this to your security team

“How many of our links still use RSA or elliptic‑curve key exchange, and how long does the data on them need to stay secret?”

If that time, plus the time it takes to switch, reaches past Q‑Day, you’re already behind.

Not sure how to answer it? We’ll help you find out
How it differs

The secret never crosses the wire.

Public key exchange was invented in 1976 so strangers could agree on a secret in public. IPsec and TLS still open every link that way, even between your data center and a branch office that have known each other for years.

The same link today and with PacketLoq Today the key exchange crosses the link in the open and is recorded. With PacketLoq the key is placed at both ends in advance, session keys are computed at each end, and a recording of the link holds nothing to break. TODAY: THE STANDARD EVERYONE TRUSTS Site A+ IPsec or TLS Site B+ IPsec or TLS KEY EXCHANGE Recorded, and breakable by a quantum computer WITH PACKETLOQ KEY FILL 1 Site A+ PacketLoq Site B+ PacketLoq 3 Recorded, but nothing to break 2computed here 2computed here DECRYPTED STILL UNREADABLE Q‑DAY The same link today and with PacketLoq TODAY: THE STANDARD EVERYONE TRUSTS Site A+ IPsec/TLS Site B+ IPsec/TLS KEY EXCHANGE Recorded, and breakableby a quantum computer WITH PACKETLOQ KEY FILL 1 Site A+ PacketLoq Site B+ PacketLoq 3 Recorded, butnothing to break 2 Session key computed at each end DECRYPTED STILL UNREADABLE Q‑DAY
  1. 1
    The key is placed in advance.Loaded at both ends before any traffic flows, so it never travels over the link.
  2. 2
    Session keys are worked out at each end.Both sides arrive at the same key independently, with no public negotiation.
  3. 3
    Keys rotate on their own.Every hour or every gigabyte, with old keys wiped from memory.
The result
  • A recording of the link is worthless
  • No handshake for a quantum computer to attack
  • Still safe after Q‑Day

Already turning on post‑quantum VPN?

Good. Keep it. The new post‑quantum standard makes the key exchange harder to break. It still sends one, and that exchange is still being recorded. PacketLoq sends none. Run both, and the links whose data must stay secret for decades stop depending on any key exchange holding up. And it works whatever VPN, router or firewall sits at each end, with no matching firmware required.

PacketLoq’s approach is its own invention.Patent pending in the US, Canada and the EU.

Where it fits

Find the link you’re responsible for

PacketLoq protects links between endpoints you provision: your own sites, servers, cloud instances and managed devices, or a counterparty you have a contract with. For talking to strangers on the open internet, keep TLS.

Protects links in any of these layouts

  • Site to site
  • Hub and spoke
  • Mesh
  • Client to server

Select your industry

If you run encryption for a bank

Branch to core, and data center replication

Payment instructions and account records cross circuits you don’t own and must stay confidential for decades.

PacketLoq protects those links, and because you own both ends, there’s nobody else to negotiate with.

  • Confidential for7–30 years
  • Sits underneathYour IPsec site-to-site
  • Runs onServers you already run

Start with one branch link and a packet capture.

Talk to us about a pilot
The product

One binary, on servers you already run.

PacketLoq sits at the edge of each site. Everything behind it stays the same.

Running in an afternoon

Install it from one ISO, with no new appliance to buy or rack.

  • One binary, one ISO
  • Zero dependencies
  • amd64, arm64, riscv64

Keys you control, custody you can prove

Your auditors see who touched which key and when. Destroyed keys are gone for good.

  • Encrypted vault
  • Crypto ignition key
  • Full audit log
  • Three-pass zeroize

Invisible to your applications

No changes to your apps, and users won’t notice it’s there.

  • Layer 3
  • Application-transparent
  • NAT-traversable
  • ~5% overhead

One link, or your whole network

Start with a single branch and grow to every site, without redesigning anything.

  • Up to 32 tunnels per appliance
  • Hub-and-spoke
  • Automatic OSPF routing

Runs quietly, reports everything

Your operations team gets live status and alerts in the tools they already use.

  • Web interface
  • Serial console
  • 25-command API
  • Prometheus
  • Four alert channels

Cryptography your auditors already trust

Standard, heavily studied ciphers. The difference is in how the keys are handled.

  • AES-256-GCM
  • ChaCha20-Poly1305
  • High-assurance mode
The best way to judge it is on your own link.

PacketLoq isn’t sold off the shelf. We start with a conversation, then a live capture on a link you pick.

Request a demonstration
Works with what you run

The missing piece, not a replacement.

PacketLoq is the last thing your data passes through before it leaves a site, and the first thing it meets when it arrives. Your VPN, TLS and endpoint tools stay exactly where they are. They already do their jobs. They just weren’t built for a recording that gets decrypted years later.

Everyone else adds something.

We take the weak point away.

How others are getting ready for Q‑Day

  • +
    Post‑quantum firmware upgradesAdds a stronger key exchange, still sent in the open
  • +
    Hardware link encryptorsAdds a new box at every site
  • +
    Key‑delivery servicesAdds an outside key service to depend on
  • +
    Quantum key distributionAdds special hardware and dedicated fiber

How PacketLoq does it

  • −
    PacketLoqRemoves the key exchange itself, so there’s nothing left to break. On hardware you already own.
Who we are

Built from experience. Shaped by what’s at stake.

PacketLoq is a small, senior team based in Seattle and working remotely.

Our founding engineers built their careers in satellite ground systems and defense communications, where security and reliability are operational requirements, not selling points. Our product and GTM leaders have taken cloud platforms and enterprise software to market at scale.

The product began with a problem on the founders’ own network: a large transfer between two sites could bring the connection to a crawl. Solving it led them to rethink how they protected data in transit. That work became the foundation for PacketLoq.

Those roots shape the product today: deliberate engineering, uncompromising key custody, and an approach to operations built for people who cannot afford surprises.

  • Based inSeattle, Washington
  • How we workFully remote
  • Came fromSatellite, defense, cloud platform
  • What we buildEncryption for data in motion
  • Talk to us[email protected]
Next step

Bring us a link and a packet analyzer

Tell us which link you’re responsible for and what runs on it today. If a capture demo isn’t worth your afternoon, we’ll tell you.

[email protected]

Include the link type, the throughput and what sits at each end. We’ll let you know whether we’re a fit, even if the answer is no.

Request a demonstration
↑